CVE-2026-116638 Details

A vulnerability exists in the Windows Recovery Environment (WinRE) on Windows 10 and 11, allowing an attacker to bypass UEFI/BIOS password protections. This issue arises because WinRE can be accessed without entering the administrator password, even when security policies are active. The vulnerability was discovered on an HP ZBook Firefly 14 inch G11, but it is not limited to this device. It poses a risk in environments where physical access to the machine is possible, potentially leading to unauthorized modifications of the boot configuration or access to sensitive data.

Microsoft has published an advisory related to hardening recovery environments and secure boot configurations. Organizations should review this guidance and evaluate their systems for susceptibility to WinRE-based firmware security bypasses. For high-security environments, it is recommended to disable or restrict WinRE, require administrative authorization before invoking recovery environments, enable BitLocker with TPM + PIN or TPM + Startup Key, restrict the use of removable media with EFI System Partitions, deploy endpoint detection and response solutions that support pre-boot security, and implement physical security controls for high-value systems.